ansaurus

Question

Find what unknown function does in C using gdb

Answer 1

+1 A:

Look at the disassembly:

gdb ./prog
b FUNCTION_NAME_HERE
r
disassemble

Edit:

The disassembly looks like SPARC. You may want to start by checking out the stack lay-out of the SPARC architecture:

http://www.sics.se/~psm/sparcstack.html

%fp sounds like the framepointer. There are not that many load instructions using %fp. My guess would be that

0x000143d4 <m+128>:  ld  [ %fp + -28 ], %g1
0x000143d8 <m+132>:  ld  [ %fp + -44 ], %o4

are the function's arguments.

sisis 2010-03-31 02:05:42

posted the disassembly, is there a way to see which assembly variables are which c variables? thanks

Gary 2010-03-31 02:13:00

cool, this is not x86, it's SPARC. But how much more is there? can you post everything all the way up to the ret statement?

sisis 2010-03-31 02:19:10

okay, that's all of it - quite a bit.. i see, i've done some x86 assembly before but never dealt with SPARC. how do you think I should go about understanding all this?

Gary 2010-03-31 02:26:19

@Gary: if the executable has been stripped, the c variable names are not recoverable. A common trick is to give names to memory locations based on where they get used. What you are trying to do here is called reverse engineering, and it is pretty well documented http://www.ethicalhacker.net/content/view/152/24/

Justin Smith 2010-03-31 02:27:23

Justin, is it possible to step through the assembly by instruction and check the variable values? If so - could you tell me how or link me somewhere that tells me? Thanks!

Gary 2010-03-31 03:21:18

'si' will step by assembly instruction in gdb. 'i r' will show the current contents of the registers. To look at where execution is heading, you can do "print $pc ($pc)+20" (which will show the next 20 bytes of upcoming instructions). It would probably be good to make note of what is being stored in memory, and then what is done with those values, etc... the trick is figuring out reasonable names for the variables. Since you are so new to assembly, another trick is to try to write out simple c code that would compile to the existing assembly (bit by bit, through trial and error, of course).

Justin Smith 2010-03-31 04:06:27

Another thing to note is that in emacs M-x gdb-many-windows will show the current status of the registers in one panel, any automatically printed expressions in another, and your command line for interacting with gdb in another etc. which may speed up your productivity as compared to just using gdb from the command line.

Justin Smith 2010-03-31 04:14:12

ansaurus

tags:

views:

answers:

Find what unknown function does in C using gdb

related questions